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LI 


75 


("709"/$.ccls. or "3807$.ccls. or 
"713"/$.ccls. or "7267$.ccls.) and 
(((unix or linux or window? or "os" 
or operating) with hook?)) and 
(rouge or hijack$ or risk or security 
or malware or virus or viruses or 
trojan? or worm? or commandeer$ 
or attack$ or compromis$ or 
corrupt$ or countermeasur$ or 

ovcnnt)Wi|) or uuc or inuubion or 

"ids") and (frame$ or buffer$ or 
stack$) and (("ret" or return) with 
(exception? or interrupt^ or 
instruction? or command or 
function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBMJTDB 


OR 


OFF 


2007/07/30 10:04 


L2 


156 


(((unix or linux or window? or "os" 
or operating) with hook?)) and 
(rouge or hijack$ or risk or security 
or malware or virus or viruses or 
trojan? or worm? or commandeer$ 
or attack$ or compromis$ or 
corrupt$ or countermeasur$ or 
ovciriiowip or uuc or intrusion or 
"ids") and (frame$ or buffer$ or 
stack$) and (("ret" or return) with 
(exception? or interrupt^ or 
instruction? or command or 
function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBMJTDB 


OR 


OFF 


2007/07/30 10:07 


L3 


67 


(((unix or linux or window? or "os" 
or operating) with hook?)) and 
(rouge or hijack$ or risk or security 
or malware or virus or viruses or 
trojan? or worm? or commandeer$ 
or attack$ or compromis$ or 
corrupt$ or countermeasur$ or 
overriiowip or mdc or intrusion or 
"ids") and (frame$ or buffer$ or 
stack$) and (("ret" or return) with 
(exception? or interrupt^ or 
instruction? or command or 
function)) 


US-PGPUB; 
EPO; JPO 


OR 


OFF 


2007/07/30 10:08 


S5 


0 


("7097$.ccls. or "380"/$.ccls. or 
"7137$.ccls. or "726"/$.ccls.) and 

//m ; i L _ I II II L 1 II \ 

windows nooks or os nooks ) 
and (malware or virus or viruses or 
trojan? or worm? or commandeer$ 
or attack$ or compromis$ or 
corrupt$ or countermeasur$ or 
overfllow$) with (buffer$ or stack$)) 


US-PGPUB; 
USPAT; 

rnri . inn, 

EPO; JPO; 

DERWENT; 

IBMJTDB 


OR 


OFF 


2007/03/06 11:11 



7/30/07 10:14:59 AM 
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S8 



S9 



S10 



20 



S15 



144 



("7097$.ccls. or "380"/$.ccls. or 
"7137$.ccls. or "726"/$.ccls.) and 
(((unix or linux or window$ or "os") 
adj2 (hook? or stall$)) and 
(malware or virus or viruses or 
trojan? or worm? or commandeer$ 
or attack$ or compromis$ or 
corrupt$ or countermeasur$ or 
overfllow$) with (buffer$ or stack$)) 

("7097$.ccls. or "380"/$.ccls. or 
"713 , 7$.ccls. or "726"/$.ccls.) and 
(((unix or linux or window$ or "os") 
adj2 (hook? or stall$)) and 
(malware or virus or viruses or 
trojan? or worm? or commandeer$ 
or attack$ or compromis$ or 
corrupt$ or countermeasur$ or 
overfllow$) with (call or "api" or 
buffer$ or stack$)) 

(((unix or linux or window$ or "os") 
adj2 (hook? or stall$)) and 
(malware or virus or viruses or 
trojan? or worm? or commandeer$ 
or attack$ or compromis$ or 
corrupt$ or countermeasur$ or 
overfllow$) with (call or "api" or 
buffer$ or stack$)) 

("7097$.ccls. or "380"/$.ccls. or 
"7137$.ccls. or "7267$.ccls.) and 
(((unix or linux or window$ or "os" 
or "operating system") adj2 (hook? 
or stall$ or intercept? or interdict$ 
or captur$)) and (malware or virus 
or viruses or trojan? or worm? or 
commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$) with 
(call or "api" or buffer$ or stack$)) 

("7097$.ccls. or "3807$.ccls. or 
M 713"/$.ccls. or "726"/$.ccls.) and 
(((unix or linux or window$ or "os" 
or "operating system" or Solaris or 
"os9") same (event or exception or 
hook? or stall$ or intercept? or 
interdict$ or captur$)) and (malware 
or virus or viruses or trojan? or 
worm? or commandeer$ or attack$ 
or compromis$ or corrupt$ or 
countermeasur$ or overfllow$) with 
(thread? or process or call or "api" 
or buffer$ or stack$ or 
application?)) and dispatch$ and 
@ad<"20030925" 



US-PGPUB; 


OR 


OFF 


I ICDATi 






EPO; JPO; 






DERWENT; 






IBM TDB 






US-PGPUB; 


OR 


OFF 


USPAT; 






EPO; JPO; 






DERWENT; 






IBMJTDB 






US-PGPUB; 


OR 


OFF 


USPAT; 






EPO; JPO; 






DERWENT; 






IBMJTDB 






US-PGPUB; 


OR 


OFF 


USPAT; 






CD^< IDA, 

brU, JrU, 






DERWENT; 






IBMJTDB 






US-PGPUB; 


OR 


OFF 


USPAT; 






EPO; JPO; 






DERWENT; 






IBMJTDB 













2007/02/27 16:30 



2007/02/27 16:33 



2007/02/27 16:32 



2007/02/27 16:50 



2007/03/01 14:25 
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388 


(((unix or linux or window$ or "os" 
or "operating system" or Solaris or 
"os9") same (event or exception or 
hook? or stall$ or intercept? or 
interdict$ or captur$)) and (malware 
or virus or viruses or trojan? or 
worm? or commandeer$ or attack$ 
or com prom is-p or corrupt^ or 
countermeasur$ or overfllow$) with 
(thread? or process or call or "api" 
or buffer$ or stack$ or 
application?)) and dispatch$ and 
@ad<"20030925" 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBMJTDB 


OR 


OFF 


2007/03/01 14:30 


S17 


141 


(((unix or linux Or window$ or "os" 
or "operating system" or solan's or 
"os9") same (event or exception or 
hook? or stall$ or intercept? or 
interdict$ or captur$)) and (malware 
or virus or viruses or trojan? or 
worm? or commandeer$ or attack$ 
or compromisj)) or corrupt or 
countermeasur$ or overfllow$) with 
(thread? or process or call or "api" 
or buffer$ or stack$ or 
application?)) and dispatch$ and 
handler? and @ad<"20030925" 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBMJTDB 


OR 


OFF 


2007/03/01 14:30 


S18 


0 


("709"/$.ccls. or "380"/$.ccls. or 
"713"/$.ccls. or "7267$.ccls.) and 
(((window? or "os" or operating) 
adjl hook?)) and (malware or virus 
or viruses or trojan? or worm? or 
commandeer$ or attack$ or 
compromise or corrupts or 
countermeasur$ or overfllow$ or 
"libc") and (frame$ or buffer$ or 
stack$) and (("ret" or return) adj2 
(instruction? or command or 
function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBMJTDB 


OR 


OFF 


2007/03/06 11:18 


S19 


59 


("709"/$.ccls. or "3807$.ccls. or 
"713"/$.ccls. or "7267$.ccls.) and 
(((window? or "os" or operating) 
with hook?)) and (malware or virus 
or viruses or trojan? or worm? or 
comma ndeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$ or 
"libc") and (frame$ or buffer$ or 
stack$) and (("ret" or return) with 
(instruction? or command or 
function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM TDB 


OR 


OFF 


2007/03/06 11:21 
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61 


("7097$.ccls. or "380"/$.ccls. or 
"713"/$.ccls. or "7267$.ccls.) and 
(((window? or "os" or operating) 
with hook?)) and (malware or virus 
or viruses or trojan? or worm? or 
comma ndeer$ or attack$ or 
compromise or cor r upup or 
countermeasur$ or overfllow$ or 
"libc" or intrusion or "ids") and 
(frame$ or buffer$ or stack$) and 
(("ret" or return) with (instruction? 
or command or function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/06 11:22 


S21 


67 


("709"/$.ccls. or "380"/$.ccls. or 
"713"/$.ccls. or "726"/$.ccls.) and 
(((window? or "os" or operating) 
with hook?)) and (security or 
malware or virus or viruses or 
trojan? or worm? or commandeer$ 
or attack$ or compromis$ or 

rr\rr\ i r\t"<fc r\r rr\\ mhormoaci irdr r\r 

LorrupLq) or Luuiiicr nicdbur«p or 
overfllow$ or "libc" or intrusion or 
"ids") and (frame$ or buffer$ or 
stack$) and (("ret" or return) with 
(instruction? or command or 
function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/06 11:30 


S22 


68 


("709"/$.ccls. or "380"/$.ccls. or 
"713"/$.ccls. or "726"/$.ccls.) and 
(((window? or "os" or operating) 
with hook?)) and (security or 
malware or virus or viruses or 
trojan? or worm? or commandeer$ 
or attack$ or compromis$ or 
corrupt$ or countermeasur$ or 
oveniiow$ or ndc or intrusion or 
"ids") and (frame$ or buffer$ or 
stack$) and (("ret" or return) with 
(exception? or interrupt$ or 
instruction? or command or 
function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/06 11:48 


S23 


68 


("709"/$.ccls. or "380"/$.ccls. or 
"7137$.ccls. or "726"/$.ccls.) and 
(((window? or "os" or operating) 
with hook?)) and (hijack$ or risk or 
security or malware or virus or 
viruses or trojan? or worm? or 
comma ndeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$ or 
"libc" or intrusion or "ids") and 
(frame$ or buffer$ or stack$) and 
(("ret" or return) with (exception? or 
interrupt$ or instruction? or 
command or function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM TDB 


OR 


OFF 


2007/07/30 09:58 
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147 (((window? or "os" or operating) 
with hook?)) and (hijack$ or risk or 
security or malware or virus or 
viruses or trojan? or worm? or 
commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$ or 
"libc" or intrusion or "ids") and 
(frame$ or buffer$ or stack$) and 
(("ret" or return) with (exception? or 
interrupt$ or instruction? or 
command or function)) 



US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM TDB 



OR 



OFF 



2007/03/06 11:51 
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